How to prevent cypress from printing secrets in the request body? - security

Question

So we're doing the following in our cypress tests:
login(user: SimpleUser) {
cy.request({
method: "POST",
url: `${this.apiUrl}/login`,
body: {
username: user.email,
password: "mypassword",
}
})
.should(assertStatusOk)
.then((resp) => {
...
which is pretty similar to what they suggest on their page.
However, when the login fails, it then logs to the console:
The request we sent was:
Method: POST
URL: myurl
Headers: {
"Connection": "keep-alive",
"user-agent": "myuseragent",
"accept": "*/*",
"accept-encoding": "gzip, deflate",
"content-type": "application/json",
"content-length": mycontentlength
}
Body: {"username":"myusername","password":"mypassword"}
where the real password is logged. Can this be prevented? I've read in other threads to add the {log: false} option when doing a cy.type, but for cy.request this doesn't seem to have an impact. Any ideas how I can prevent cypress from printing the full body?

Answer 1

In the case of status code errors, you can add failOnStatusCode: false to the request options.
cy.request({
method: "POST",
url: `http://example.com/login`,
failOnStatusCode: false,
log: false,
body: {
username: user.email,
password: "mypassword",
}
})
.should('have.property', 'status', '200')
Then all you see is expected { Object (body, headers, ...) } to have property status of '200', but got 404.
If you have other error types than bad status code, substituute a plain fetch() for cy.request().